What Is the FDBR? Florida Digital Bill of Rights

The Florida Digital Bill of Rights (FDBR), codified at Fla. Stat. 501.701 et seq., is Florida's comprehensive consumer data privacy law. It was enacted as Senate Bill 262 (2023), signed by Governor Ron DeSantis on June 6, 2023, and took effect July 1, 2024, giving Florida residents rights to access, correct, delete, and port their personal data and to opt out of sale, targeted advertising, profiling, and certain data collection.

As of 2026, the FDBR is the narrowest comprehensive state privacy law in the country at its core: the central "controller" obligations reach only for-profit businesses that make more than $1 billion in global gross annual revenues and fit one of three big-technology profiles. A separate set of broader provisions in the same package reaches far more businesses, and the Florida Department of Legal Affairs enforces all of it with civil penalties of up to $50,000 per violation, triplable in defined cases.

Jurisdiction scope: This covers Florida's Florida Digital Bill of Rights (Fla. Stat. 501.701 et seq.). It is general legal information, not legal advice.

What the FDBR is: statute, enactment, and effective date

The Florida Digital Bill of Rights is Florida's first comprehensive consumer data privacy law. It is codified at Florida Statutes Sections 501.701 through 501.722, within Part V of the state's consumer protection chapter. The short title in 501.701 expressly states that the part "may be cited as the Florida Digital Bill of Rights."

The Florida Legislature passed it as Senate Bill 262 during the 2023 session. Governor Ron DeSantis signed the bill into law on June 6, 2023, and the act took effect July 1, 2024. As of 2026, that effective date has passed, so every covered business is now fully subject to the law and the Department of Legal Affairs is actively enforcing it.

SB 262 was framed politically around protecting consumers and especially children from large technology platforms. That framing is visible in the statute's structure: the headline obligations are aimed squarely at the largest companies, while a separate cluster of provisions reaches a much broader set of businesses. For the parent overview of Florida privacy obligations, see the Florida data privacy laws hub.

The $1 billion controller threshold: why the FDBR targets Big Tech

The FDBR's defining feature is the definition of "controller" in 501.702(9), which is the narrowest in the country. A business is a covered controller only if it is organized for profit, conducts business in this state, collects personal data about consumers, determines the purposes and means of processing that data alone or jointly with others, makes in excess of $1 billion in global gross annual revenues, and satisfies at least one of three additional prongs in 501.702(9)(a)6. The broader "conducts business in this state or produces a product or service used by residents of this state" language sits in the separate applicability provision at 501.703(1)(a), not in the controller definition, so a company with no Florida business presence does not become a controller merely because Floridians use its product.

The first prong, in 501.702(9)(a)6.a., is deriving 50 percent or more of its global gross annual revenues from the sale of advertisements online, including providing targeted advertising or the sale of ads online. This prong captures the largest ad-driven platforms.

The second prong, in 501.702(9)(a)6.b., is operating a consumer smart speaker and voice command component service with an integrated virtual assistant connected to a cloud computing service that uses hands-free verbal activation. The statute carves out a motor vehicle or a speaker or device associated with or connected to a vehicle operated by a motor vehicle manufacturer or its subsidiary or affiliate. This prong is aimed at major voice-assistant makers.

The third prong, in 501.702(9)(a)6.c., is operating an app store or a digital distribution platform that offers at least 250,000 different software applications for consumers to download and install. This prong reaches the dominant mobile app marketplaces.

The practical effect is that the FDBR's core controller obligations apply to only a handful of the very largest technology companies. A business that makes less than $1 billion globally, or that exceeds $1 billion but fits none of the three prongs, is not a "controller" and is outside the central duties of the law.

The broader provisions that reach far more businesses

It would be a serious mistake to read the FDBR as a Big-Tech-only statute and stop there. SB 262 created several provisions that apply well beyond the $1 billion controller, and Florida businesses of ordinary size must heed them.

First, the sale-of-sensitive-data consent rule in 501.715 prohibits a person meeting the controller definition's structural prongs in 501.702(9)(a)1.-3. from engaging in the sale of personal data that is sensitive data without prior consent from the consumer, or, for a known child, without the required authorization or compliance with the Children's Online Privacy Protection Act. Sensitive data is defined to include biometric data, so this functions as a sale-of-sensitive-biometric-data consent rule.

Second, the children's online protections in 501.1735 reach online platforms that provide an online service, product, game, or feature likely to be predominantly accessed by children, regardless of the $1 billion threshold. That section restricts processing a known child's personal data in ways that cause harm, prohibits certain dark patterns, and limits collecting a known child's precise geolocation without consent.

Third, SB 262 amended the breach-notification statute 501.171 to add biometric data (as defined in 501.702) and geolocation information to the definition of covered personal information, broadening data-breach duties for businesses generally. The bill also added 112.23, which restricts governmental entities from coordinating with social media platforms to remove or moderate content. Together these provisions mean the FDBR package touches many businesses that are not "controllers."

Consumer rights and the voice and facial recognition opt-out

Against a covered controller, Florida consumers hold the now-familiar suite of state privacy rights under 501.705: to confirm processing and access their personal data, to correct inaccuracies, to delete data, to obtain a portable copy, and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects.

The FDBR adds two opt-out rights that set it apart. Under 501.705(2)(f), a consumer may opt out of the collection of sensitive data, including precise geolocation data. Under 501.705(2)(g), a consumer may opt out of the collection of personal data collected through the operation of a voice recognition or facial recognition feature.

Those two collection opt-outs are distinctive. Most state privacy laws let consumers opt out of selling or using sensitive data, but Florida lets a consumer opt out of its collection in the first place, and singles out voice and facial recognition features by name. The FDBR consumer rights guide walks through every right, the response window, and the appeal process in detail.

FDBR vs. CCPA: the key differences

Florida's FDBR and California's CCPA are frequently compared by companies that operate nationally. The state data privacy law comparison page covers the broader multistate picture, but several differences between the FDBR and California's CCPA stand out.

The most consequential difference is coverage. California's thresholds are disjunctive and reach a broad swath of businesses, while Florida's core controller test is conjunctive and aimed at only the largest technology firms. The second major difference is Florida's voice and facial recognition collection opt-out, which California does not match in the same form. The takeaway for a multistate business is that being outside the FDBR's controller definition does not necessarily mean being outside the CCPA, and the FDBR's broader provisions can still apply.

Related guides

• Florida data privacy laws parent hub
• FDBR consumer rights
• FDBR compliance checklist
• State data privacy law comparison
• What is the CCPA?

More Florida Laws

• Florida Deepfake Laws
• Florida Employee Monitoring Laws
• Florida GPS Tracking Laws
• Florida Recording Laws

Frequently Asked Questions

What is the Florida Digital Bill of Rights?

The Florida Digital Bill of Rights (FDBR) is Florida's comprehensive consumer data privacy law, codified at Fla. Stat. 501.701 to 501.722. It was enacted as Senate Bill 262, signed by Governor Ron DeSantis on June 6, 2023, and took effect July 1, 2024. It gives Florida residents rights over their personal data and imposes core obligations on a narrow set of very large technology companies, plus broader provisions that reach more businesses.

When did the Florida Digital Bill of Rights take effect?

The FDBR took effect July 1, 2024, more than a year after it was signed on June 6, 2023. As of 2026, the effective date has passed, the law is fully in force, and the Florida Department of Legal Affairs has begun publishing annual enforcement reports and pursuing enforcement actions under it.

Who has to comply with the Florida Digital Bill of Rights?

The core controller obligations under 501.702(9) apply only to a for-profit business that makes more than $1 billion in global gross annual revenues AND meets one of three prongs: 50 percent or more of revenue from online advertising; operating a consumer smart speaker and voice assistant service; or operating an app store or digital distribution platform with at least 250,000 different applications. This is the narrowest controller test of any state privacy law.

Why is the FDBR called the narrowest privacy law in the country?

Because its core controller definition in 501.702(9) requires more than $1 billion in global revenue plus one of three big-technology prongs, the central obligations reach only a handful of the largest platforms. Most other state laws cover businesses based on far lower revenue or data-volume figures, so the FDBR's central duties apply to a much smaller group.

Does the FDBR apply to small and mid-size Florida businesses?

Generally not for the core controller obligations, because those require more than $1 billion in global revenue under 501.702(9). But broader provisions do reach smaller businesses: the children's online protections in 501.1735 apply to platforms likely to be predominantly accessed by children, and amendments to the breach-notification statute 501.171 add biometric and geolocation data for businesses generally.

What is the voice and facial recognition opt-out?

Under 501.705(2)(g), a Florida consumer may opt out of the collection of personal data collected through the operation of a voice recognition or facial recognition feature. This is a distinctive FDBR right that singles out those biometric features by name, in addition to the broader right under 501.705(2)(f) to opt out of the collection of sensitive data, including precise geolocation.

How is the FDBR different from the CCPA?

The FDBR's core coverage is far narrower: it requires more than $1 billion in global revenue plus a big-tech prong (501.702(9)), while the CCPA reaches businesses on revenue, data volume, or data-sale revenue alone. The FDBR adds a voice and facial recognition collection opt-out that California does not match in the same form. Both treat sensitive data specially, but the FDBR uses opt-in to process and an opt-out of collection, and neither has a general private right of action under the FDBR (501.72(8)).

Who enforces the Florida Digital Bill of Rights?

The Florida Department of Legal Affairs, part of the Attorney General's office, has exclusive enforcement authority under 501.72. There is no private right of action (501.72(8)). The department may grant a discretionary 45-day cure period, and civil penalties run up to $50,000 per violation, triplable for violations involving a known child, failure to delete or correct after a request, or continued sale or sharing after an opt-out.